This invention relates to a method and system for facilitating the management of appropriate security measures associated with various business practices. In particular, the present invention relates to a computerized system and method for structuring the practice of security management by assisting business managers quantify a level of security appropriate for a given business situation and generate suggested security measures commensurate with a risk event.
The proliferation of means to exchange information coupled with an increasingly rapid pace of conducting business transactions can create uncertainty on the part of a business manager as to what security measures are appropriate for a given business situation. Where it was once possible to physically contain information within a secure building or other confine, electronic communications have greatly expanded the realm in which security measures must be made effective. Increased use of wireless communications, facsimile machines, e-mail, the Internet, file servers, and other non-traditional means of communications have expanded the possible forums where information can be intercepted and otherwise misappropriated.
In addition, sophisticated surveillance equipment and techniques have increased the capabilities of those who wish to surreptitiously gather information. Staying abreast of techniques used in corporate espionage and other efforts used to gather vital information is often beyond the scope of a business participant struggling to keep pace with a changing marketplace. Consequently, appropriate measures to counter modern surveillance are left unattended. A typical business participant may not fully understand the danger posed by corporate espionage nor do they have knowledge of how to effectively address it. Even if they are aware of effective security measures, there can be uncertainty surrounding when it becomes appropriate to implement such security measures.
Effectively determining appropriate security actions can be complicated. Risk variables, such as a geographic location and a type of computer network may seem completely unrelated to a layman business manager. However, a security expert may be concerned about a certain type of computer network, such as a wireless network, in an urban setting comprising multiple tenants and high pedestrian traffic. In the urban setting, the network may be more susceptible to violation, such as by a neighboring tenant, a pedestrian, or even a party in a neighboring building. Similarly, risk associated with a wireless network may be almost non-existent in a suburban office park setting occupied by a homogeneous tenant. Relationships between individual risk variables can require sophistication and know how far beyond the scope of an average business manager.
In addition, it would be helpful to be able quantify what measures are taken or to reassure a potential business partner with an upfront commitment to a level of security that will be applied to a business situation.